BoringSecurity

Good security is boring security. Incident response, business continuity, policy, governance, awareness culture. Not a hacker.

[BoringSecurity @wachusec]

@lawrencekingyo Do the thing
No more thing to do
Seek new thing to do
Repeat

[BoringSecurity @wachusec]

I went from fintech management to an analyst role at 32 and havent regretted it a day. And it only took me a couple years to get back to a management role.

[BoringSecurity @wachusec]

@FitFounder When they start accepting campaign donations from the SUN

[BoringSecurity @wachusec]

@AccidentalCISO Hope you have the coffee machine in your hardware asset inventory

[BoringSecurity @wachusec]

Safety and security go hand in hand. Its the security teams job to consider safety first and foremost. And there are a lot of parallels with what O’Neil did which we can apply to security.

[BoringSecurity @wachusec]

Looking to modernize your security program this year? Here is one approach that will make the whole C-suite appreciate your infsoec team.

[BoringSecurity @wachusec]

We often think of applying CIA to data. But we should apply it to everything in our business. Systems, processes, people, physical.

[BoringSecurity @wachusec]

Similar to Paul O’Neil transformed Alcoa as their CEO. He focused on one thing: Safety. And completely transformed the culture. By reporting, tracking, and remediating all safety incidents he led the company to bounds of operational efficiencies and innovations.

[BoringSecurity @wachusec]

Of course you have your SOC managing events and incidents which should also be reported and follow the same post mortems. Impactful incidents should be prioritized, tracked, and reported to management.

[BoringSecurity @wachusec]

Really drill down the WHY as to how there was an impact to CIA. Find your common and impactful post mortems. You should ask WHY at least 3 times to get to a proper post mortem.

[BoringSecurity @wachusec]

What will this do? This will give your security team enormous amounts of operational data on mishaps and inefficiencies with the business. With proper business impact analysis and system inventory (which many security teams custodian) track these and perform post mortems

[BoringSecurity @wachusec]

Door into building is jammed? Someone couldn’t log onto the VPN? You might have accidentally emailed the wrong customer? Report it all.

[BoringSecurity @wachusec]

@DroppedmicAgain The man

[BoringSecurity @wachusec]

@Rugged_Legacy Speaks to the point that a lot of bosses are not interested in or skilled at being good mentors. I've been lucky in that regard

[BoringSecurity @wachusec]

@lawrencekingyo Can apply the 80/20 rule to this as well. Really only 20% of the stuff you're working on or concerned with today matters, the other 80% is just filler.

[BoringSecurity @wachusec]

@thedankoe Finally got up at 4:30 today to get my workout in and get all my work done before the kids were up. Now I have a full day with the kids, don't need to try and fit everything in in between!

[BoringSecurity @wachusec]

@H3KTlC Try practice tests on your phone. They're the core aspect of obtaining the cert and great for short attention spans.

[BoringSecurity @wachusec]

Technology does not need to be boring. Security does.